CVE-2017-11671
Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED…
Does this matter?
Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.
Description
Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.
- CVSS 3.0
- 4.0 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-338
- Affected
- gnu/gcc
- Source
- cve@mitre.org
References
- http://openwall.com/lists/oss-security/2017/07/27/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/100018Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0849
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180Issue Tracking, Vendor Advisory
- https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.htmlMailing List
- http://openwall.com/lists/oss-security/2017/07/27/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/100018Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0849
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180Issue Tracking, Vendor Advisory
- https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.htmlMailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.